CVE-2002-0504: High severity Citrix Nfuse vulnerability
Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other clients via the NFuseApplication parameter to (1) launch.jsp or (2) launch.asp.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2002-0504?
CVE-2002-0504 has a moderate severity level due to its potential for causing cross-site scripting attacks.
How do I fix CVE-2002-0504?
To fix CVE-2002-0504, it is important to upgrade Citrix NFuse to version 1.7 or later, ensuring input validation and proper output encoding.
What software versions are affected by CVE-2002-0504?
CVE-2002-0504 affects Citrix NFuse versions 1.6 and earlier, including specifically 1.51.
What type of vulnerability is CVE-2002-0504?
CVE-2002-0504 is a cross-site scripting (XSS) vulnerability that allows remote attackers to execute arbitrary scripts in the context of another user's session.
What can attackers do with CVE-2002-0504?
Attackers exploiting CVE-2002-0504 can manipulate user sessions to steal cookies or sensitive information from users of the affected application.